This report also applies to audit-2.2-2.el6. Problem with non-existing audit events is caused by handling --proof option for both successful an unsuccessful login the same way (if (proof) { } branch in report_session function in aulast.c). Setting low/low priority/severity.

Fixed in upstream commit 765.

This request was evaluated by Red Hat Product Management for
inclusion in the current release of Red Hat Enterprise Linux.
Because the affected component is not scheduled to be updated
in the current release, Red Hat is unable to address this
request at this time.

Red Hat invites you to ask your support representative to
propose this request, if appropriate, in the next release of
Red Hat Enterprise Linux.

audit-2.3.7-1.el6 was built to resolve this issue.

Unfortunately, I still see b) issue from the description:

Suppose I try to log in to the system twice:

1. first with correct username but incorrect password
2. and then with incorrect username 

There should be exactly two bad logins reported by aulast in my
opinion. Instead I see three records:

testuser ssh   ::1      Mon Jul 28 14:45 - 14:45 (00:00)
(unknown ssh   ::1      Mon Jul 28 14:45 - 14:45 (00:00)
(invalid ssh   ::1      Mon Jul 28 14:45 - 14:45 (00:00)

First line is created by step 1. Next two lines are created by 2. If
possible, it would be the best to have just a single line for step 2
containing also username used during log-in attempt.

(audit-2.3.7-3.el6)

Created attachment 923874 [details]
Aulast State Diagram

Missed one transition. I think this is a final draft.

So, base on the state diagram, the troubleshooting step would be to do a search on the USER_LOGIN events because that is what determines bad login vs full user session. A bad login should be found with:

ausearch -m USER_LOGIN -sv no

To aid in getting a log for troubleshooting (weeding out irrelevant events), you can do something like this:

ausearch --start yesterday -m system_boot,system_shutdown,daemon_start,login,user_start,user_end,user_login > audit.log

Then test with "aulast -f audit.log"

Thanks a lot Steve for your insight and for the state diagram. It definitely looks like pam/openssh issue right now. I am moving this bug back to ON_QA and the issue is now tracked in Bug 1127312 for pam.

Of course you need to add --raw to the ausearch command in comment #15. Then you can hand edit the invalid user entry from the log. That should be cleaner for testing.

It looks like one issue from the description was forgotten or fixed incompletely - reporting non-existing event numbers in for unsuccessful logins:

# aulast --bad --proof
testuser ssh          ::1              Tue Aug 12 05:48 - 05:48  (00:00)
    audit event proof serial numbers: 102, 0, 17591959120944
    Session data can be found with this search:
    ausearch --start 08/12/2014 05:48:39 --end 08/12/2014 05:48:39

Audit events with serials 102 and 0 exist, but 17591959120944 does not.

It is not a serious issue and it is definitely not worth respin I just want to make sure that you, Steve, are aware of it.

Fixed better in upstream commit 990.

Thanks Steve. 

OK, I consider original issue successfully verified now with audit-2.3.7-5.el6:

NEW
===

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: Test
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   PASS   ] :: Correct login (Expected 0, got 0)
:: [   PASS   ] :: Checking correct login (Assert: testuserpts/2localhostSunAug1016:56-16:56(00:00)X should equal testuserpts/2localhostSunAug1016:56-16:56(00:00)X)
:: [   PASS   ] :: Checking the number of correct logins (Assert: 11 should equal 11)
:: [   PASS   ] :: Incorrect login (wrong password) (Expected 8, got 8)
:: [   PASS   ] :: Checking incorrect login (Expected 0, got 0)
:: [   PASS   ] :: Checking the number of incorrect logins (Assert: 1 should equal 1)
:: [   PASS   ] :: Checking the number of correct logins (Assert: 11 should equal 11)
:: [   PASS   ] :: Incorrect login (wrong username) (Expected 8, got 8)
:: [   PASS   ] :: Checking incorrect login (Expected 0, got 0)
:: [   FAIL   ] :: Checking the number of incorrect logins (Assert: 3 should equal 2)

See Comments from #7 to #17.

:: [   PASS   ] :: Extracting records to aulast.log (Expected 0, got 0)
:: [   PASS   ] :: File aulast.log should exist 
:: [   PASS   ] :: Checking '--stdin' option (Assert: 11 should equal 11)
:: [   PASS   ] :: Checking '-f <file>' option (Assert: 11 should equal 11)
:: [   PASS   ] :: Checking '-f' with a non-existing file (Expected 1, got 1)
:: [   PASS   ] :: Checking related events (single login) (Assert: 0 should equal 0)
:: [ WARNING  ] :: Event 140734120552200 does not exist!
:: [ WARNING  ] :: Event 4197563 does not exist!
:: [   FAIL   ] :: Checking related events (all logins) (Assert: 1 should equal 0)

See Comment #18 and #19.

:: [   LOG    ] :: Duration: 31s
:: [   LOG    ] :: Assertions: 15 good, 2 bad
:: [   FAIL   ] :: RESULT: Test

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-1515.html